Expose sv app endpoints to the minimum users by nicu-da · Pull Request #6934 · canton-network/splice

nicu-da · 2026-08-24T14:18:21Z

Also extend open api so the other SVs can easily apply the same restriction

[static]

part of https://github.com/DACH-NY/canton-network-internal/issues/743 (still misses cf-docs part)

Pull Request Checklist

Cluster Testing

If a cluster test is required, comment /cluster_test on this PR to request it, and ping someone with access to the DA-internal system to approve it.
If an upgrade test is required, comment /upgrade_test on this PR to request it, and ping someone with access to the DA-internal system to approve it.
If a hard-migration test is required (from the latest release), comment /hdm_test on this PR to request it, and ping someone with access to the DA-internal system to approve it.
If a logical synchronizer upgrade test is required (from canton-3.5), comment /lsu_test on this PR to request it, and ping someone with access to the DA-internal system to approve it.

PR Guidelines

Include any change that might be observable by our partners or affect their deployment in the release notes.
Specify fixed issues with Fixes #n, and mention issues worked on using #n
Include a screenshot for frontend-related PRs - see README or use your favorite screenshot tool

Merge Guidelines

Make the git commit message look sensible when squash-merging on GitHub (most likely: just copy your PR description).

canton-network-da · 2026-08-24T14:18:45Z

[backport] Reminder

Please consider backporting to the following branches:

release-line-0.7.4
release-line-0.7.3
release-line-0.7.1
release-line-0.7.0

▶️ Please check the boxes for branches that you wish to backport to and backport PRs will
automatically be created when you merge this PR.

And your PR is currently against base branch: main.

Note: Any PR comment containing [backport] will be considered for auto-backporting upon merge,
you can always add those manually for PRs that did not get these reminders. You can also edit
this comment manually and add more branches that this should be backported to.

martinflorian-da · 2026-08-24T14:33:53Z

    post:
      tags: [sv]
      x-jvm-package: sv_public
+      x-public-audience: validators


my understanding is that this endpoint will go away as part of #3596

Yes, this doesn't affect the current status quo

martinflorian-da · 2026-08-24T14:35:09Z

      tags: [sv]
      # TODO(DACH-NY/canton-network-internal#2106) Move to sv_operator
      x-jvm-package: sv_public
+      x-public-audience: validators


This endpoint should not exist IMO, and certainly is not needed by any validators. (Scan has the same one.)

So how about we keep your PR here as it is but start deprecating that endpoint?

Orthogonal concern, I think we should deprecate it but in another PR

oh yes, totally; feel free to keep your PR as is; follow-up: #6957

martinflorian-da · 2026-08-24T14:35:31Z

    post:
      tags: [sv]
      x-jvm-package: sv_public
+      x-public-audience: validators


Same as /v0/onboard/validator

martinflorian-da

Thanks! ...with naming comments that since this is going to be hard to change once we tell SVs about it are less nit than usual...

martinflorian-da · 2026-08-24T15:28:15Z

      tags: [sv]
      # TODO(DACH-NY/canton-network-internal#2106) Move to sv_operator
      x-jvm-package: sv_public
+      x-public-audience: validators


So how about we keep your PR here as it is but start deprecating that endpoint?

martinflorian-da · 2026-08-24T15:33:08Z

+          annotation to restrict the external exposure of their SV app: only the endpoints of a
+          given audience need to be reachable from the corresponding networks, and endpoints with
+          an audience of ``none``, as well as endpoints without an ``x-public-audience``, do not
+          need to be exposed to external traffic at all.


Suggested change

need to be exposed to external traffic at all.

need to be exposed to external traffic at all.

Note that endpoints currently marked for exposure to validators will be phased out in the foreseeable future.

Not sure how I feel about including this here. Indeed those endpoints will be removed with some release, but that will be part of the release notes for that time.

Are you willing to risk some SV operator or product person asking concerned questions about "oh wait we need to make the SV app public as well?". Seems like a low-cost investment to avoid that risk.

"oh wait we need to make the SV app public as well?".

But we do need to make at least one endpoint public on DevNet. Does it matter if it's devnet only? It's still a prod cluster

Well sure but this is a nuance we can introduce later on :) Currently it is correct to say that the current selection of endpoints will be phased out.

Your call, but I reserve my right to say "I told you so" in case people do get confused :)

Added the note and expanded saying that new endpoints will be added just for devnet.

martinflorian-da · 2026-08-24T15:35:25Z

+describe('the SV OpenAPI spec', () => {
+  const content = fs.readFileSync(svOpenApiFile, 'utf-8');
+
+  test('declares an x-public-audience for every sv_public endpoint', () => {


martinflorian-da · 2026-08-24T15:55:56Z

By the way, from the discussion on canton-network/cf-docs#1450 : do we want to block DevNet-only endpoints already on the istio layer somehow? Definitely nice to have, but probably not worth the effort to do in a precise way... So our guidance should probably be "sv-app exposed only on DevNet". (I'd add that to an issue not add that immediately.)

Also extend open api so the other SVs can easily apply the same restriction [static] Signed-off-by: Nicu Reut <nicu.reut@digitalasset.com>

[static] Signed-off-by: Nicu Reut <nicu.reut@digitalasset.com>

nicu-da · 2026-08-26T12:03:15Z

cc @pasindutennage-da you will need to add the annotation to your public endpoint as well

nicu-da requested a review from martinflorian-da August 24, 2026 14:18

nicu-da mentioned this pull request Aug 24, 2026

Add rate limits initial documentation canton-network/cf-docs#1450

Merged

martinflorian-da reviewed Aug 24, 2026

View reviewed changes

martinflorian-da approved these changes Aug 24, 2026

View reviewed changes

nicu-da added 2 commits August 26, 2026 08:15

Expose sv app endpoints to the minimum users

11314d9

Also extend open api so the other SVs can easily apply the same restriction [static] Signed-off-by: Nicu Reut <nicu.reut@digitalasset.com>

review

4933ed6

[static] Signed-off-by: Nicu Reut <nicu.reut@digitalasset.com>

nicu-da force-pushed the nicu/ip_whitelist/restrict_sv_app branch from 3a20f9e to 4933ed6 Compare August 26, 2026 08:16

.

618a30c

[static] Signed-off-by: Nicu Reut <nicu.reut@digitalasset.com>

nicu-da merged commit 738a4dc into main Aug 26, 2026
44 checks passed

nicu-da deleted the nicu/ip_whitelist/restrict_sv_app branch August 26, 2026 12:03

	need to be exposed to external traffic at all.
	need to be exposed to external traffic at all.
	Note that endpoints currently marked for exposure to validators will be phased out in the foreseeable future.

Uh oh!

Conversation

nicu-da commented Aug 24, 2026

Pull Request Checklist

Cluster Testing

PR Guidelines

Merge Guidelines

Uh oh!

canton-network-da commented Aug 24, 2026

[backport] Reminder

Please consider backporting to the following branches:

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

martinflorian-da left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

martinflorian-da Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

martinflorian-da commented Aug 24, 2026

Uh oh!

nicu-da commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

martinflorian-da Aug 24, 2026 •

edited

Loading